Analysis
-
max time kernel
91s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2022, 10:36
Static task
static1
Behavioral task
behavioral1
Sample
5d11b009391ffab30cc00ae878a915c7bcbd2c486c2dd125a3d43fcd06e36102.dll
Resource
win7-20220901-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
5d11b009391ffab30cc00ae878a915c7bcbd2c486c2dd125a3d43fcd06e36102.dll
Resource
win10v2004-20220901-en
1 signatures
150 seconds
General
-
Target
5d11b009391ffab30cc00ae878a915c7bcbd2c486c2dd125a3d43fcd06e36102.dll
-
Size
23.5MB
-
MD5
0627fe1acad5caaf3fdffb410b7fda92
-
SHA1
c7e88b72b0967d54b87a891172561c66d98cbdb8
-
SHA256
5d11b009391ffab30cc00ae878a915c7bcbd2c486c2dd125a3d43fcd06e36102
-
SHA512
62a7c03b161c4705562f060660af145afc5b8362fb5674048787d53cf985b9ccc322ed238617cc84a3cc6699d4144b0851f0a15739dc648ea78bfbe2a1dcbf2d
-
SSDEEP
393216:VUm4pL3QIdcBXMfbrFlVQml8/bUhr39Cq:VURpL3S1MPbl6bijp
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3360 wrote to memory of 388 3360 rundll32.exe 80 PID 3360 wrote to memory of 388 3360 rundll32.exe 80 PID 3360 wrote to memory of 388 3360 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5d11b009391ffab30cc00ae878a915c7bcbd2c486c2dd125a3d43fcd06e36102.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5d11b009391ffab30cc00ae878a915c7bcbd2c486c2dd125a3d43fcd06e36102.dll,#12⤵PID:388
-